create-brainerce-store 1.57.0 → 1.58.0

package/dist/index.js

@@ -31,7 +31,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "create-brainerce-store",
-      version: "1.57.0",
+      version: "1.58.0",
       description: "Scaffold a production-ready e-commerce storefront connected to Brainerce",
       bin: {
         "create-brainerce-store": "dist/index.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-brainerce-store",
-  "version": "1.57.0",
+  "version": "1.58.0",
   "description": "Scaffold a production-ready e-commerce storefront connected to Brainerce",
   "bin": {
     "create-brainerce-store": "dist/index.js"

package/templates/nextjs/base/src/components/checkout/payment-step.tsx

@@ -77,6 +77,13 @@ export function PaymentStep({ checkoutId, className }: PaymentStepProps) {
   const { storeInfo } = useStoreInfo();
 
   const [paymentIntent, setPaymentIntent] = useState<PaymentIntent | null>(null);
+
+  // The provider's payment URL. `clientSdk.renderArg` is the URL; `clientSecret`
+  // is only a fallback for providers that duplicate it there. Reading
+  // clientSecret alone breaks providers that return a real identifier (MAX,
+  // Takbull) — the iframe/link silently points at an id instead of a page.
+  const paymentIntentUrl =
+    paymentIntent?.clientSdk?.renderArg || paymentIntent?.clientSecret || '';
   const [preloadedSdk, setPreloadedSdk] = useState<PaymentClientSdk | null>(null);
   const [loading, setLoading] = useState(true);
   const [error, setError] = useState<string | null>(null);
@@ -368,12 +375,20 @@ export function PaymentStep({ checkoutId, className }: PaymentStepProps) {
       // Sandbox mode — no SDK to load, UI handles it
       if (sdk.renderType === 'sandbox') return;
 
+      // The URL to send the customer to is `renderArg`; `clientSecret` is only
+      // a fallback for providers that duplicate the URL into it. Reading
+      // clientSecret first silently breaks any provider that puts a real
+      // identifier there (MAX, Takbull) — the host check rejects the id and the
+      // customer never reaches the payment page. Mirrors the sdk-widget branch
+      // above, which already prefers renderArg.
+      const paymentUrl = sdk.renderArg || intent.clientSecret;
+
       if (sdk.renderType === 'redirect') {
-        if (!isAllowedPaymentUrl(intent.clientSecret)) {
+        if (!isAllowedPaymentUrl(paymentUrl)) {
           setError(t('paymentRedirectBlocked'));
           return;
         }
-        safePaymentRedirect(intent.clientSecret);
+        safePaymentRedirect(paymentUrl);
         return;
       }
 
@@ -383,13 +398,13 @@ export function PaymentStep({ checkoutId, className }: PaymentStepProps) {
       //   (2) a Brainerce-hosted embed page on an allowlisted payment host
       //       that wraps provider-specific logic (e.g. Cardcom OpenFields).
       if (sdk.renderType === 'iframe') {
-        if (!isAllowedPaymentUrl(intent.clientSecret)) {
+        if (!isAllowedPaymentUrl(paymentUrl)) {
           setError(t('paymentRedirectBlocked'));
           return;
         }
         const iframeOrigin = (() => {
           try {
-            return new URL(intent.clientSecret).origin;
+            return new URL(paymentUrl).origin;
           } catch {
             return '';
           }
@@ -622,7 +637,7 @@ export function PaymentStep({ checkoutId, className }: PaymentStepProps) {
       return (
         <div className={cn('w-full', className)}>
           <iframe
-            src={paymentIntent.clientSecret}
+            src={paymentIntentUrl}
             className="block w-full border-0"
             style={iframeStyle}
             title={t('payment')}
@@ -681,7 +696,7 @@ export function PaymentStep({ checkoutId, className }: PaymentStepProps) {
             </div>
             {/* Iframe body */}
             <iframe
-              src={paymentIntent.clientSecret}
+              src={paymentIntentUrl}
               className="w-full border-0"
               style={iframeStyle}
               title={t('payment')}
@@ -724,7 +739,7 @@ export function PaymentStep({ checkoutId, className }: PaymentStepProps) {
       <p className="text-muted-foreground mt-4 text-sm">{t('redirectingToPayment')}</p>
       <p className="text-muted-foreground mt-2 text-xs">
         {t('redirectingHint')}
-        <a href={paymentIntent.clientSecret} className="text-primary hover:underline">
+        <a href={paymentIntentUrl} className="text-primary hover:underline">
           {t('clickHere')}
         </a>
         .